Executive Summary
| Summary | |
|---|---|
| Title | Updated OpenSSL packages fix vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2004:119 | First vendor Publication | 2004-03-17 |
| Vendor | RedHat | Last vendor Modification | 2004-03-17 |
| Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2004-119.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11755 | |||
| Oval ID: | oval:org.mitre.oval:def:11755 | ||
| Title: | OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. | ||
| Description: | OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0081 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:5528 | |||
| Oval ID: | oval:org.mitre.oval:def:5528 | ||
| Title: | OpenSSL 0.9.6k ASN.1 DoS Vulnerability | ||
| Description: | OpenSSL 0.9.6k allows remote attackers to cause a denial of service (crash via large recursion) via malformed ASN.1 sequences. | ||
| Family: | ios | Class: | vulnerability |
| Reference(s): | CVE-2003-0851 | Version: | 1 |
| Platform(s): | Cisco IOS | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:871 | |||
| Oval ID: | oval:org.mitre.oval:def:871 | ||
| Title: | Red Hat Enterprise 3 OpenSSL Improper Unknown Message Handling Vulnerability | ||
| Description: | OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0081 | Version: | 2 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | OpenSSL |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:902 | |||
| Oval ID: | oval:org.mitre.oval:def:902 | ||
| Title: | Red Hat OpenSSL Improper Unknown Message Handling Vulnerability | ||
| Description: | OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0081 | Version: | 2 |
| Platform(s): | Red Hat Linux 9 | Product(s): | OpenSSL |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-05-05 | Name : HP-UX Update for AAA Server HPSBUX01011 File : nvt/gb_hp_ux_HPSBUX01011.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200403-03 (OpenSSL) File : nvt/glsa_200403_03.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 465-1 (openssl,openssl094,openssl095) File : nvt/deb_465_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 4318 | OpenSSL TLS Infinite Loop DoS OpenSSL contains a flaw that may allow a remote denial of service. The issue is triggered when unknown TLS message types are sent to it, which creates an infinite loop and will result in loss of availability for OpenSSL or the application using it. |
| 2765 | OpenSSL ASN.1 Large Recursion DoS There is a flaw in OpenSSL running on Windows that can be used to make OpenSSL crash causing a Denial of Service. The flaw is in the way that OpenSSL handles ASN.1 tags. A remote attacker can cause OpenSSL to enter a large recursion by sending a specifically crafted certificate. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-01-04 | Name : The remote server is vulnerable to a denial of service attack. File : openssl_0_9_6l.nasl - Type : ACT_GATHER_INFO |
| 2005-11-02 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-1042.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-465.nasl - Type : ACT_GATHER_INFO |
| 2004-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200403-03.nasl - Type : ACT_GATHER_INFO |
| 2004-07-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-095.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote host is missing a Mac OS X security update. File : macosx_SecUpd20031219.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd20040503.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote host is using an unsupported version of Mac OS X. File : macosx_version.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-119.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-120.nasl - Type : ACT_GATHER_INFO |
| 2004-03-17 | Name : The remote service is prone to a denial of service attack. File : openssl_denial.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:48:26 |
|
